General Data Protection Regulation
Information to data subjects
The regulation requires to inform about:
- legal basis for data processing
- period of conservation of them
- transfer of the same.
All privacy policies and texts that provide information to data subjects must be reviewed.
Exercise of the rights of data subjects
The regulation requires the exercise of the rights of the data subjects.
In this way, the requests for exercise of this right become:
- monitored
- documented
- to have maximum response time
- the right to data portability
- Right to data elimination
- notification of third parties about the rectification or deletion or limitation of treatment requested by the holders
PRACTICES
Send mails only to those who have requested or are your client.
Do not transfer the data or document well what is done.
Informed consent of data subjects
The regulation requires controlling the circumstances in which the consent of the holders was obtained when this is the legal basis for the processing of personal data.
There are a set of requirements to obtain this consent and its non-compliance requires obtaining a new consent.
Notification of security violations
The regulation requires that all security violations that result in risk to the rights of the holders be communicated to the control authority as well as to the respective data holders.
Other information
There is specific regulation for sensitive information. Personal data or children have more rules and in some cases they have to be encrypted.
Subcontraction also has to comply with the rules.
It may be necessary to indicate a responsible for the processing of the data.
The fines are substantial.
You should consult a lawyer or other specialists if you have doubts.
PRACTICES
You cannot have a list of mails without maintenance.
It has to record the requests and the treatment made.
Examples
Some normal cases and frequent issues.
Customer sheet
It will always have to keep data on the client and billing. In some cases it has legal requirements to maintain this information for 5 years or more.
newsletters
Use double-opt-in lists where the person has to indicate their mail and have to confirm that it was she who asked to be posted the mail.
Right of forgetfulness
Not having legal obligation to keep the data should erase all information that is requested.
It will have to be erased quickly.
Data isolation
Use SSL certificates to encode the passage of data between the PC and the server.
Have a virtual server for your accommodation to increase the level of security.